muliple(teal): Update teal
feat: Add a.starrysky.blog
feat: re-key keys with shorthairNanoResident age key
chore: update packages
fix: redo headscale options
Change-Id: I27cab9abc4622f0a69811e35d4e0eb87af29b42b
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/981
Reviewed-by: Skyler Grey <minion@clicks.codes>
Tested-by: Skyler Grey <minion@clicks.codes>
diff --git a/modules/nixos/clicks/networking/tailscale/default.nix b/modules/nixos/clicks/networking/tailscale/default.nix
index 827a3f0..118cae4 100644
--- a/modules/nixos/clicks/networking/tailscale/default.nix
+++ b/modules/nixos/clicks/networking/tailscale/default.nix
@@ -21,7 +21,7 @@
};
server = lib.mkOption {
description = "Set where your control plane server is";
- default = "clicks.domains";
+ default = "vpn.clicks.codes";
example = "controlplane.tailscale.com";
};
authKeyFile = lib.mkOption {
diff --git a/modules/nixos/clicks/nix/default.nix b/modules/nixos/clicks/nix/default.nix
index 5403d54..766462c 100644
--- a/modules/nixos/clicks/nix/default.nix
+++ b/modules/nixos/clicks/nix/default.nix
@@ -30,12 +30,6 @@
{
options.clicks.nix = {
enable = lib.mkEnableOption "Nix configuration";
- package = lib.mkOption {
- type = lib.types.package;
- default = pkgs.nix;
- defaultText = "pkgs.nix";
- description = "Which Nix package to use.";
- };
default-substituter = {
url = lib.mkOption {
@@ -68,8 +62,6 @@
users = [ "root" ];
in
({
- package = cfg.package;
-
settings = {
experimental-features = "nix-command flakes";
http-connections = 50;
diff --git a/modules/nixos/clicks/security/secrets/default.nix b/modules/nixos/clicks/security/secrets/default.nix
index 8a120f9..b165d7b 100644
--- a/modules/nixos/clicks/security/secrets/default.nix
+++ b/modules/nixos/clicks/security/secrets/default.nix
@@ -16,10 +16,14 @@
config.age = lib.optionalAttrs cfg.enable {
rekey = {
- masterIdentities = [
- "${inputs.self}/secrets/keys/minion/collabora-yubikey.pub"
- "${inputs.self}/secrets/keys/minion/tiny-yubikey.pub"
- "${inputs.self}/secrets/keys/minion/iyubikey.pub"
+ masterIdentities =
+ let
+ keyPath = "${inputs.self}/secrets/keys";
+ in [
+ "${keyPath}/minion/collabora-yubikey.pub"
+ "${keyPath}/minion/tiny-yubikey.pub"
+ "${keyPath}/minion/iyubikey.pub"
+ "${keyPath}/coded/ShorthairNano.pub"
];
storageMode = "local";
generatedSecretsDir = lib.snowfall.fs.get-snowfall-file "secrets/generated/${config.networking.hostName}";
diff --git a/modules/nixos/clicks/services/headscale/default.nix b/modules/nixos/clicks/services/headscale/default.nix
index 2d104bd..69c4c39 100644
--- a/modules/nixos/clicks/services/headscale/default.nix
+++ b/modules/nixos/clicks/services/headscale/default.nix
@@ -6,6 +6,8 @@
lib,
config,
pkgs,
+ system,
+ inputs,
...
}:
let
@@ -18,6 +20,10 @@
type = lib.types.str;
description = "The domain of the url users should connect to to register a new device";
};
+ server_url = lib.mkOption {
+ type = lib.types.str;
+ description = "The domain of the url users should connect to to register a new device";
+ };
addr = lib.mkOption {
type = lib.types.str;
description = "Where to host headscale";
@@ -48,10 +54,6 @@
description = "Client secret file path";
};
};
- database_password_path = lib.mkOption {
- type = lib.types.str;
- description = "Database password file path";
- };
noise_private_key_path = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = "Noise private key file path";
@@ -71,16 +73,15 @@
config = lib.mkIf cfg.enable {
clicks = {
- services.postgres.enable = true;
- services.postgres.databases.headscale = cfg.database_password_path;
- services.postgres.secretRequiredGroups = [ "headscale" ];
services.nginx.enable = true;
- services.nginx.hosts.${cfg.domain} = {
+ services.nginx.hosts.${cfg.server_url} = {
service = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port;
www = false;
# TODO: disable http when we have changed a1d2's reverse proxy config to allow us to terminate HTTPS
enableHttp = true;
};
+
+ storage.impermanence.persist.directories = [ "/var/lib/headscale" ];
};
services.headscale = {
@@ -89,34 +90,27 @@
address = cfg.addr;
port = cfg.port;
- settings.db_type = "postgres";
- settings.db_port = config.services.postgresql.settings.port;
- settings.db_user = "headscale";
- settings.db_password_file = cfg.database_password_path;
- settings.db_name = "headscale";
- settings.db_host = lib.clicks.constants.hosts.standard;
+ package = lib.recursiveUpdate inputs.headscale.packages.${system}.headscale ({ meta.mainProgram = "headscale"; });
- settings.server_url = "https://${cfg.domain}";
-
- settings.ip_prefixes = "100.64.0.0/10";
+ settings.server_url = "https://${cfg.server_url}";
settings.noise.private_key_path = lib.mkIf (
cfg.noise_private_key_path != null
) cfg.noise_private_key_path;
- settings.private_key_path = lib.mkIf (cfg.private_key_path != null) cfg.private_key_path;
- settings.dns_config = {
- nameservers = [
+ settings.dns = {
+ nameservers.global = [
"1.1.1.1"
"1.0.0.1"
+ "2606:4700:4700::1111"
+ "2606:4700:4700::1001"
];
- domains = [ cfg.domain ];
- override_local_dns = true;
base_domain = cfg.domain;
};
settings.oidc = lib.mkIf cfg.oidc.enable {
only_start_if_oidc_is_available = true;
+ strip_email_domain = true;
issuer = cfg.oidc.issuer;
@@ -124,17 +118,12 @@
client_secret_path = cfg.oidc.client_secret_path;
allowed_groups = lib.mkIf (cfg.oidc.allowed_groups != null) cfg.oidc.allowed_groups;
- strip_email_domain = true;
};
- settings.acl_policy_path = lib.mkIf (cfg.acl != null) (
- pkgs.writers.writeJSON "tailscale-acls.json" cfg.acl
- );
+ settings.policy = lib.mkIf (cfg.acl != null) {
+ mode = "file";
+ path = (pkgs.writers.writeJSON "tailscale-acls.json" cfg.acl);
+ };
};
-
- systemd.services.headscale.requires = [ "postgresql.service" ] ++
- (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
- systemd.services.headscale.after = [ "postgresql.service" ] ++
- (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
};
}
diff --git a/modules/nixos/clicks/services/postgres/default.nix b/modules/nixos/clicks/services/postgres/default.nix
index 0f6b71f..836bf71 100644
--- a/modules/nixos/clicks/services/postgres/default.nix
+++ b/modules/nixos/clicks/services/postgres/default.nix
@@ -2,13 +2,14 @@
#
# SPDX-License-Identifier: GPL-3.0-only
-{ lib, config, ... }:
+{ lib, config, pkgs, ... }:
let
cfg = config.clicks.services.postgres;
in
{
options.clicks.services.postgres = {
enable = lib.mkEnableOption "Postgresql DB";
+ latest = lib.mkEnableOption "Use pinned PG version, otherwise default to 15.10";
databases = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
@@ -34,6 +35,7 @@
lib.mkIf cfg.enable {
services.postgresql = {
enable = true;
+ package = if cfg.latest then pkgs.postgresql else pkgs.postgresql_15;
settings = {
listen_addresses = lib.mkForce lib.clicks.constants.hosts.standard;
diff --git a/modules/nixos/clicks/sites/a.starrysky.blog/default.nix b/modules/nixos/clicks/sites/a.starrysky.blog/default.nix
new file mode 100644
index 0000000..51058fc
--- /dev/null
+++ b/modules/nixos/clicks/sites/a.starrysky.blog/default.nix
@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: 2024 Clicks Codes
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+{ config, inputs, lib, system, pkgs, ... }:
+let
+ siteUrl = "a.starrysky.blog";
+ blogTitle = "A Starry Blog";
+ publicTitleRegex = ''(M36\.31\+[0-9]+ )?(?<title>.*)'';
+ blogPath = "/persist/data/var/lib/silverbullet/Skyler Grey/M36 Personal/30-39 Creativity/31 Blog";
+in
+{
+ options.clicks.sites."${siteUrl}".enable = lib.options.mkEnableOption "Enable hosting https://${siteUrl}";
+
+ config = lib.modules.mkIf config.clicks.sites."${siteUrl}".enable {
+ clicks.services.nginx = {
+ enable = true;
+
+ hosts.${siteUrl} = {
+ service = lib.clicks.nginx.http.directory "/var/lib/whisk/${siteUrl}";
+ www = false;
+ enableHttp = true;
+ };
+ };
+
+ environment.systemPackages = [ pkgs.nodejs-slim_23 ];
+
+ systemd.services."${siteUrl}-setup" = {
+ script = ''
+ export PATH=${pkgs.nodejs-slim_23}/bin:${pkgs.pnpm}/bin::$PATH
+ WORKDIR=$(mktemp -d)
+ cp -r ${inputs.whisk}/frontend/* $WORKDIR
+ cd $WORKDIR
+ pnpm i --reporter=append-only
+
+ mkdir -p /var/lib/whisk
+ rm -rf /var/lib/whisk/${siteUrl}
+
+ export BLOG_PATH='${blogPath}'
+ export PUBLIC_TITLE_REGEX='${publicTitleRegex}'
+ export SITE_URL='${siteUrl}'
+ export BLOG_TITLE='${blogTitle}'
+
+ echo $BLOG_PATH
+
+ pnpm run build --outDir /var/lib/whisk/${siteUrl}
+ '';
+
+ serviceConfig.Type = "oneshot";
+
+ path = [ pkgs.nodejs-slim_23 pkgs.pnpm ];
+
+ wantedBy = [ "nginx.service" ];
+ before = [ "nginx.service" ];
+ };
+ };
+}